Bulgarian Ministry of Transport Conceals Results of the Probe in the FinSpy Server Mind the horns!

Capture_2013-09-26_a_17.23.46

Three weeks after WikiLeaks exposed the Bulgarian government in being a client of the Dreamlab company for the aggressive spyware FinSpy, there is still no response from institutions about who has purchased it and what is its use.

Information by Wikileaks confirmed a publication of the computer lab Citizen Lab, which in early May found in Bulgaria a control server of FinSpy using the IP address of the former Ministry of Public Administration. On June 15, Transport Minister Papazov acknowledged that – quote: “the damage could be huge, but experts have insisted before us that it is not possible to have such a program loaded on one of our computers.” The Minister ordered a probe in the case.

Bivol requested from the Ministry of Transport information on the results of the probe and received instead a vague explanation, stating the Ministry of Transport and Information Technologies had not purchased spyware FinSpy and FinFisher. The answer does not make clear what exactly was checked and if such program has been found on a server of the former Ministry of Public Administration.

It is also unclear why, if “the damage could be huge,” the prosecution did not launch their own probe. The mere presence of such server equals computer crime. Unless otherwise authorized for the purposes of law enforcement, intentionally infecting someone’s computer with a virus is punishable under Article 319 of the Penalty Code.

Published to date documents show unambiguously that Bulgarian institutions lie and that one of them has bought and has used against its own citizens aggressive spyware from companies designated by “Reporters without Borders” as “Enemies of the Internet.” This puts Bulgaria alongside dictatorial countries like Iran, Turkmenistan, Azerbaijan and other third world States, clients of firms for mass surveillance of online communications.

Bivol inquired whether Bulgaria is a client that purchases spyware from companies such as Dreamlab, Gamma, Trovicor, including before the Minister of Interior Tsvetlin Yovchev, but so far has not received any answers

However, it received threats from a dubious “representative” of the company producing FinSpy.

After the publication, Bivol received on its editorial email ambiguous messages from an individual named Svetoslav Bonchev, who in his profile on the professional network LinkedIn and in the one on Facebook, presents himself as a trade representative of Dreamlab, Trovicor and other businesses related to the spy industry. To confirm that this is the same person, Bivol sent a request via Stanislav Bonchev’s profile on Facebook and received confirmation that he was precisely the person who wrote us the email, and not an impostor.

“Many people called me already, asking me what was going on, how can you post this and how did you obtain this information on FinSpy, as there is no input from the appointed expert probe or testimony, as far as I know. Moreover, there isn’t any evidence in the case and therefore I think that these are all lies … I also think that your will act as reasonable people and will keep away from this topic because you do not know what you are getting in, and you seem like good guys; we have many mutual friends, and it will be sad if something happens to you.”- Bonchev wrote on September 5.

Bonchev, however, did not respond to repeated inquiries from Bivol to provide proof that he really is an accredited representative of Gamma, Vupen and Dreamlab in Bulgaria. There is no answer from the companies either to confirm that they have such representative. A more detailed research of Bivol established that though notorious in IT circles, Bonchev is not a “reliable source.”

Bivol wrote about Stansilav Bonchev a few days before the general elections in May, in connection with the illegal wiretaps scandal. It was found then that Bonchev’s uncle owns the “Multiprint” printing house in the town of Kostinbrod where a few days after the publication, prosecutors discovered a large number of voting ballots, exceeding by much the contracted ones. Bonchev’s father – Krasimir, on his part, owns another printing house – “Polycart,” which prints secret folders and envelopes for the Interior Ministry.

Is Bonchev actually linked with spyware companies and with people who may harm Bivol? For now, the only certain thing is that he is eager to belong to the secret services. Pre-trial proceedings are currently ongoing against him because he used a fake ID card of employee of the State Agency for National Security, DANS, with which he tried to “respect” acquaintances. Information from the prosecution reveals that Bonchev is not being held responsible for making the fake ID, but only for using it.

Updated 03 October 2013

After the English version of this article was published, Bivol received by email the following statement by VUPEN CEO Chaouki Bekrar: “We do NOT know any Bonchev, this person is NOT an accredited representative of VUPEN, and we do NOT have any other representative in Bulgaria. This profile is fake and we have now contacted LinkedIn to remove it asap”

Capture_2013-09-26_a_23.19.07